5b80e57adc8ec2194d109c05cd7b192b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5b80e57adc8ec2194d109c05cd7b192b_JaffaCakes118
Size

241KB
MD5

5b80e57adc8ec2194d109c05cd7b192b
SHA1

c3e3875fa529333a1f23efc3d62f39374e81f4c4
SHA256

100d00c9b4d39d39b07fffab62a79cd6ac878227048de5a2dad952ee6b13f5e7
SHA512

679550a56f6e1d414f1d02d69e1b38d3aba9ff6366707dd5b1afaaacb624586803c5d304e92dc12b640658d26b09e898d6f8979503cfddbc605c0a1479393ad6
SSDEEP

6144:ARm5uz/00VV78RFXsEL88Lb6b1rvO7Qd82HFDknhx7:Acc/zV9O8aq1rj8+Cx7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b80e57adc8ec2194d109c05cd7b192b_JaffaCakes118

Files

5b80e57adc8ec2194d109c05cd7b192b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

43ffdceafa9b5f356c5f5f5e021a47cd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
GetCurrentProcess
ExitProcess
CreateFileA
LCMapStringA
LoadLibraryA
CloseHandle

user32

CharLowerBuffA
CreateWindowExA
wsprintfA
CloseWindow
SetWindowLongA

advapi32

RegDeleteValueA
RegDeleteKeyA
RegOpenKeyA
RegEnumKeyA
RegCloseKey
RegSetValueA
RegEnumValueA
RegQueryValueA
RegCreateKeyA

Sections

.text
Size: 122KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ